Hello, I am using Splunk Enterprise with IT Essentials Work, Windows Addon and Content Pack for Windows Dashboards and Reports. I made all the necessary configurations for Content Pack for Windows Dashboards and Reports but still I can not see any data in dashboards or the reports.  In eventtypes.conf file in DA-ITSI-CP-windows-dashboards/local folder i made the following changes  [windows_index_windows] definition= index=windows OR index=main [perfmon_index_windows] definition= index=perfmon OR index=itsi_im_metrics [wineventlog_index_windows] definition= index=wineventlog OR index=main   The think the problem starts from the fact that eventtypes are not recognized in searches. For example the search  (eventtype=msad-successful-user-logons OR eventtype=msad-failed-user-logons) returns nothing. In eventttypes.conf the above stanza is: [msad-successful-user-logons] search = eventtype=wineventlog_index_windows eventtype=wineventlog_security EventCode=4624 user!="*$"   If i run the search: index=main EventCode=4624 user!="*$" i get results.   Can someone help me to solve the problem?   Thanks [msad_index_windows] search= index=msad OR index=main ... View more